Privacy Notice

Last updated: 14 September 2026

This privacy notice applies to the Turvix application. It explains how Turvix Oy (Business ID 3573062-8) processes the personal data of application users, invited users, people who join a waitlist, customer-organization contacts, and other people whose data a customer adds to the application.

The service is intended for businesses, public-sector bodies, associations, and other organizations, and for use in a trade or profession. It is not intended for consumer use.

1. Controller and Processing Roles

Turvix Oy (Business ID 3573062-8) is the controller of personal data processed for accounts, authentication, billing, support, service security, and management of its own operations.

Where a customer organization determines the purposes and means of processing personal data it adds to the application, the customer organization is the controller and Turvix Oy processes the data on its behalf to provide the service. For requests concerning such data, please contact the relevant organization first. The customer organization is responsible for having an appropriate basis to add other people's data to the service.

Privacy contact: support@turvix.fi

2. Personal Data We Process

Depending on how you use the service and which features are enabled, we process:

  • Account and profile data: email address, first and last name, user identifiers, language preference, and email-notification setting.
  • Authentication and session data: sign-in events and sessions, and identifiers and use metadata for sign-in methods such as multi-factor authentication and passkeys. We do not receive biometric data held by your device.
  • Organization and invitation data: organization name, memberships, roles, an invited person's email address and optional name, inviter, and the invitation's status and validity.
  • Customer-provided data: questionnaire answers, domains, work and contact email addresses, and data used for tasks, risks, and document generation.
  • Automated-check data: check targets, schedules, status, technical results of domain and website checks, published breach records linked to monitored addresses, and reports that a finding was incorrect.
  • Waitlist data: email address, waitlist identifier, interface language, and the time you joined.
  • Support and feedback data: submitter name, message type, subject and content, language, whether a reply is requested, and related user and organization identifiers.
  • Subscription and billing data: subscription and billing status. Payment-card and other underlying payment details are stored only by Stripe. Turvix does not store them.
  • Technical and security data: IP address for abuse prevention, error data, and security logs of sign-in and account events.

3. Sources of Data

We receive data from you during sign-in and through profile fields, forms, the waitlist, and support requests. We also receive data from the customer organization and its administrators, from authentication and billing providers, and from public internet sources. When breach checks are enabled, we also receive data from Have I Been Pwned.

The customer organization is responsible for informing people whose data it adds to the service. We contact those people only when needed to provide the service, for example through invitations, sign-in links, and notifications. We do not separately notify every person whose data appears in customer content, check targets, or public sources where that would be impossible or involve disproportionate effort. This notice describes that processing.

4. Purposes and Legal Bases

  • Creating an account, authentication, and use of the service: processing is necessary to perform a contract with you. Where the customer is your employer or another organization, we rely on our and the customer's legitimate interests in providing and administering the service purchased by the organization.
  • Managing organizations, invitations, and access: we rely on contract performance or the legitimate interest in administering customer users and protecting access to the service.
  • Processing customer-provided data, documents, and checks: we act on the customer's instructions to provide the service. Where we act as controller, we rely on contract performance or the legitimate interest in providing the security service requested by the customer.
  • Check results and security notifications: we detect and report security risks affecting targets specified by the customer. We rely on contract performance or the legitimate interest in protecting the customer's systems and users. You can disable email notifications in your profile.
  • Paid subscriptions and accounting: we process data to perform the subscription contract and comply with applicable accounting and other legal obligations.
  • Waitlist: we store your address so we can tell you when access opens. The legal basis is consent, which you give by submitting the form.
  • Support and feedback: we rely on contract performance or the legitimate interest in responding to communications and improving service quality.
  • Logs, abuse prevention, and error investigation: we rely on our legitimate interests in protecting the service and its users, preventing abuse, investigating incidents, and maintaining service reliability.

The application does not currently use advertising or behavioral-tracking analytics.

5. Recipients and Service Providers

Personal data may be processed, to the extent required by their duties, by Turvix Oy, authorized users of the customer organization, and the following providers:

  • Supabase Pte. Ltd.: database and sign-in
  • Vercel Inc.: application hosting
  • Plus Five Five, Inc. (Resend): service email
  • Stripe Payments Europe, Limited: payments and subscriptions. Depending on the service, Stripe acts as a processor or an independent controller.
  • Superlative Enterprises Pty Ltd (Have I Been Pwned): email-address breach checks when the feature is enabled
  • GitHub, Inc. and Backblaze, Inc.: backups

Where Turvix processes Customer Content on the customer's behalf, the current list of subprocessors used by Turvix is on the subprocessors page.

Technical checks of customer domains use public internet sources.

We may disclose data to authorities or advisers where required by law or necessary to establish, exercise, or defend legal claims. We do not currently disclose personal data to advertisers.

6. Transfers Outside the EEA

Some providers operate internationally and may process data outside the EEA, including in the United States, Singapore, and Australia. Transfers rely, as applicable, on a European Commission adequacy decision, Standard Contractual Clauses, or another lawful transfer mechanism. Subprocessor-specific information is on the subprocessors page. You can request further information and a copy of applicable safeguards from support@turvix.fi.

7. Retention

  • Account, profile, membership, organization, and customer-content data is kept for the duration of the customer relationship and account use. Afterwards it is deleted from live systems within a reasonable period and from backups according to backup rotation, unless a legal obligation or legal claim requires longer retention.
  • Monitoring results are ordinarily deleted after 90 days.
  • A pending user invitation expires after 7 days by default. Invitation-status and audit data is then retained only as required for access administration, abuse prevention, or legal claims.
  • Support and feedback data is kept until the matter is handled and no further action is reasonably expected, and afterwards only as required for legal claims or legal obligations.
  • Waitlist data is kept until we invite you to the service, you ask us to delete it, or the list ends. Afterwards it is deleted within a reasonable period, unless a legal obligation or legal claim requires longer retention.
  • Audit and error logs are ordinarily kept for 90 days to protect the service, prevent abuse, and investigate incidents. Data may be kept longer for an unresolved security incident, abuse investigation, or legal claim.
  • Billing and accounting data is kept during the customer relationship and afterwards as required by applicable accounting law and legal claims. Stripe retains data it controls under its own privacy notice.

When there is no longer a reason to retain personal data, it is deleted or anonymized where reasonably possible.

8. Cookies and Local Device Storage

The application uses cookies and local storage necessary for service operation:

  • authentication-provider cookies used to maintain the sign-in session
  • the selected-organization identifier for up to one year
  • local interface settings until you remove them from your browser.

These technologies are used to provide the service and functions you request, not for advertising. If we introduce non-essential analytics or advertising technologies, we will request consent where required by law.

9. Automated Checks

The application performs automated technical checks and uses them to produce statuses, findings, and guidance. The checks do not make solely automated decisions about individuals that produce legal or similarly significant effects.

10. Required and Optional Data

An email address is required to sign in, and an organization name is required to set up the service. Without them, we cannot provide a user account and organization workspace. Providing a name is optional. Joining a waitlist requires an email address. Monitoring targets are optional, but the relevant checks cannot be performed without them. Billing and payment details required for a paid subscription are provided to Stripe; without them, a paid subscription cannot be activated.

11. Your Rights

Subject to the applicable conditions, you have the right to:

  • obtain confirmation of whether we process your data and access that data
  • have inaccurate or incomplete data rectified
  • request erasure
  • request restriction of processing
  • receive data you provided, where processed automatically under a contract, in a portable format
  • object, on grounds relating to your particular situation, to processing based on legitimate interests.

These rights are not absolute; their application depends on the purpose and legal basis of processing. Send requests to support@turvix.fi. We may request information needed to verify your identity. We respond without undue delay and normally within one month.

You may lodge a complaint with a supervisory authority, in particular in the country of your residence or work or where the alleged infringement occurred. The Finnish authority is the Office of the Data Protection Ombudsman.

12. Changes to This Notice

We may update this notice when the service or processing changes. If we begin processing personal data for a purpose other than that for which it was collected, we will provide the information required by data protection law before that processing begins.

Data controller: Turvix Oy (Business ID 3573062-8)
Privacy contact: support@turvix.fi